Date: Tue, 2 Jul 2013 12:21:42 +0200 From: Petr Matousek <pmatouse@...hat.com> To: oss-security@...ts.openwall.com Cc: spender@...ecurity.com Subject: Re: CVE request: Kernel 2.6.32+ IP_RETOPTS Buffer Poisoning DoS On Sun, Jun 30, 2013 at 12:33:47AM -0700, Steven Ciaburri wrote: > There is a local DOS exploit in centos 6, openvz 6, cloudlinux 6 and others. > > https://www.rack911.com/poc/hemlock.c Just to make sure -- this triggers Red Hat specific bug introduced via CVE-2012-3552 fix [1, 2]. This issue does not affect upstream.  https://bugzilla.redhat.com/show_bug.cgi?id=979936#c2  https://bugzilla.redhat.com/show_bug.cgi?id=979936#c3 Spender suggest there is a integer problem in the code , but there is not. The problem spender is trying to fix is avoided by the CMSG_OK check in ip_cmsg_send() function and msg_controllen check in __sys_sendmsg(). There is some slight room for error though since CMSG_OK checks for "(cmsg)->cmsg_len >= sizeof(struct cmsghdr)" and the expression is "err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));" but with the current alignment and cmsghdr struct size we should be fine on both 32 and 64bit.  https://twitter.com/grsecurity/status/351664130031222784 -- Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.